Configuring Kaspersky Security Center for export of events to a SIEM system

Expand all | Collapse all

You can enable automatic event export in Kaspersky Security Center.

Only general events can be exported from managed applications over the CEF and LEEF formats.  Application-specific events cannot be exported from managed applications over the CEF and LEEF formats. If you need to export events of managed applications or a custom set of events that has been configured using the policies of managed applications, you have to export the events in the Syslog format.

To enable automatic export of events:

1. In the Kaspersky Security Center console tree, select the Administration Server whose events you want to export.
2. In the workspace of the selected Administration Server, select the Events tab.
3. Click the drop-down arrow next to the Configure notifications and event export link and select Configure export to SIEM system in the drop-down list.

   The events properties window opens, displaying the Event export section.

4. In the Event export section, specify the following export settings:

   

   Event export section of the event properties window

   • Automatically export events to SIEM system database

     Select this check box to enable automatic export of events to SIEM systems. Selecting this check box enables all fields in the Exporting events section.

   • SIEM system

     Select the SIEM system to export the events: QRadar® (LEEF format), ArcSight (CEF format), Splunk® (CEF format), and Syslog format (RFC 5424).

   • SIEM system server address

     Specify the SIEM system server address. The address can be specified as a DNS or NetBIOS‑name or as an IP-address.

   • SIEM system server port

     Specify the port number to connect to the SIEM system server. This port number must be the same as that, which your SIEM system uses to receive the events (see section Configuring a SIEM system for details).

   • Protocol

     Select the protocol to be used for transferring messages to the SIEM system. You can select either the TCP/IP or UDP protocol. TCP/IP is more secure because it supports confirmations on receiving the message. UDP is a simpler protocol and is suitable in situations where error checking and correction is either unnecessary or is performed within the application.

   If you select Syslog format, you must specify:

   • Maximum message size, in bytes

     Specify the maximum size (in bytes) of one message relayed to the SIEM system. Each event is relayed in one message. If the actual length of a message exceeds the specified value, the message is truncated and data may be lost. The default size is 2048 bytes. This field is available only if you selected the Syslog format in the SIEM system field.

5. If you want to export to the SIEM system database the events that occurred after a specified date in the past, click the Export archive button and specify the start date for event export. By default, the event export starts immediately after you enable it.
6. Click OK.

Automatic export of events is enabled.

After enabling automatic export of events, you must select which events will be exported to the SIEM system.

See also: Scenario: configuring event export to SIEM systems Marking of events for export to SIEM systems in Syslog format

Page top